Full Report
Cisco Talos discovered a Chinese-speaking cybercrime group, tracked as UAT-10147, that targets a wide range of vulnerable web servers. This is an overview of the campaign, examining the countries affected, potential impact of BadIIS infections, the attack chain, and post-compromise tactics.
Analysis Summary
# Threat Actor: UAT-10147
## Attribution & Identity
* **Identification:** UAT-10147 is a Chinese-speaking cybercrime group first identified by Cisco Talos in early 2026.
* **Language/Origin:** Chinese-speaking (evidenced by the use of the character “萬”/“w” for numeric shorthand in target lists).
* **Actor Type:** Financially motivated intrusion operators.
* **Associations:** Assessed to be part of an emerging class of "agentic AI" users who integrate semi-autonomous orchestration into their workflows.
## Activity Summary
UAT-10147 conducts large-scale exploitation of internet-exposed Windows and Linux web servers. Their 2026 campaign involves scanning massive target lists (approx. 170,000 URLs) for vulnerabilities to deploy malware for SEO fraud and data theft. They are notable for using AI-driven tooling to automate post-compromise activities, including exploit refinement and validation.
## Tactics, Techniques & Procedures
* **Initial Access:** Exploitation of publicly disclosed vulnerabilities (N-day exploits) in web servers; ASP.NET ViewState deserialization.
* **AI-Enhanced Operations:**
* Use of **PentestGPT** and **DeepAudit** for guided exploitation.
* AI-generated operational playbooks and exfiltration scripts.
* Iterative exploit refinement and adaptive troubleshooting.
* **Privilege Escalation:** Use of "Potato-family" exploits (e.g., **EfsPotato**) to escalate to SYSTEM privileges via `SeImpersonatePrivilege`.
* **Persistence:** Deployment of web shells and the **BadIIS** malware; registry modifications.
* **Evasion:** Using `certutil` for downloads; PowerShell to add directories to Windows Defender exclusion lists; Base64 encoding (UTF-16-LE) for payloads.
* **Reconnaissance:** Automated enumeration of webroots (`C:\inetpub\wwwroot\`) and IIS site inventories via `appcmd.exe`.
* **MITRE ATT&CK IDs (Inferred from TTPs):**
* T1190: Exploit Public-Facing Application
* T1105: Ingress Tool Transfer
* T1059.001: PowerShell
* T1059.003: Windows Command Shell
* T1562.001: Disable or Modify Tools (Antivirus Exclusion)
* T1068: Exploitation for Privilege Escalation
* T1505.003: Web Shell
## Targeting
* **Sectors:** Government, Education (Universities), Media, Technology, and Gaming.
* **Geography:** Global distribution with confirmed victims/targets in Brazil, Bolivia, China, Canada, and Vietnam.
* **Victims:** Over 170,000 target URLs identified in actor-controlled infrastructure.
## Tools & Infrastructure
* **Malware:** **QuasarRAT** (disguised as `svchosts.exe`), **BadIIS**, and various web shells.
* **Offensive Frameworks:** Metasploit, ysoserial (for .NET deserialization), PentestGPT, DeepAudit.
* **Utilities:** EfsPotato (renamed `prcc1.rar`), `certutil`, `appcmd.exe`.
* **Infrastructure:**
* Download Server: `139.180.197[.]150`
* Exfiltration/Callbacks: `webhook[.]site` endpoints.
* C2/Staging: Open directories used for hosting scripts like `back.bat`, `back.txt`, and `exfil.py`.
## Implications
The group represents a shift in threat actor capabilities where AI is used not just for coding assistance, but as an **agentic orchestrator**. This allows lower-skilled actors to perform complex post-compromise tasks (reconnaissance, validation, and exfiltration) at a scale and speed previously reserved for advanced persistent threats (APTs).
## Mitigations
* **Vulnerability Management:** Prioritize patching of internet-facing web servers, specifically IIS and ASP.NET environments.
* **Configuration Hardening:** Disable `SeImpersonatePrivilege` for service accounts where not strictly required to prevent "Potato" style privilege escalation.
* **Endpoint Security:** Monitor for unauthorized use of `certutil.exe` and `powershell.exe` for downloading external files or executing Base64 encoded commands.
* **Monitoring:** Implement Snort/ClamAV signatures to detect known UAT-10147 tools (SIDs: 1:66697, 1:66696).
* **Audit Exclusion Lists:** Regularly review Windows Defender/AV exclusion lists for unauthorized paths added by attackers.